Forum Discussion
Fabric - Airflow Jobs - Notebook Access to Key Vault -mssparkutils.credentials.getSecret returns 403
Hi kaouter,
As we discussed on Discord, Fabric uses the security context of the identity that calls the API to trigger the notebook to access the keyvault.
In your case, when you have an airflow SPN triggering the notebook, that SPN is the identity that needs permissions on the keyvault for the notebook to be able to successfully authenicate to the keyvault.
It was great connecting with you on Discord and being able to help!
Super UserHi kaouter,
Notebooks will run under the context of the current user, or the notebook author if it is scheduled.
If it is run with a pipeline, then it can run under a service principal or workspace identity I believe.
Make sure the notebook creator has permissions on the keyvault. Also make sure the keyvault is either open to the public internet, or you have created a private endpoint from the fabric workspace to the keyvault.
Hi, thanks for the response!
The notebook is triggered externally via Apache Airflow, not through a Fabric Pipeline or the built-in scheduler. Airflow calls the Fabric API using a SPN to start the job. So the “notebook author” context doesn’t seem to apply here — the identity that shows up in the 403 error is neither my user account nor the SPN Airflow uses to trigger it.
That’s the confusing part. The caller appid in the token doesn’t match anything in Entra ID — not the triggering SPN, not the Workspace Identity. It looks like Fabric generates a separate runtime identity for the Spark session itself when the notebook is triggered externally.
WN: executing notebook manually or with pipeline or scheduler in fabric works perfects but i need that my notebook get the key vault when it is triggered by apache airflow job in fabric !!!
Has anyone specifically documented how identity works when Fabric notebooks are triggered via external API calls rather than Pipelines or the scheduler?